Best Practices for Creating Policies

For an overview of the segmentation process, see Get Started with Segmentation and Microsegmentation and subtopics.

Manually create policies and enforce them across the network. For example, quarantine vulnerable hosts or block unwanted traffic to your workloads from outside your network.

• Manually create policies for scopes in your scope tree. For example, to block all traffic from outside your network to every host in your network, put the policy into the scope at the top of the tree.

• If you want to be able to override the general policy for some workloads (for example, following the example above, you want to block general access from outside your network but you want some workloads to be accessible from outside the network), create the high-level policies as Default policies. Then create specific policies for the applicable workloads.

• Consider using templates to speed policy creation.

• See Manually Create Policies, Policies for Specific Purposes, and Policy Templates.

(Optional) Automatically discover policies near the top of your tree scope or across all scopes in a branch. This creates broad policies that allow existing traffic while restricting future unwanted traffic. You can then develop more specific policies to protect your network from unnecessary or undesired traffic.

For more information, see Discover Policies for One Scope or for a Branch of the Scope Tree and Discover Policies Automatically for information.

To create more detailed policies, automatically discover policies for scopes at or near the bottom of your scope tree, focusing on individual application scopes.

See Discover Policies for One Scope or for a Branch of the Scope Tree and Discover Policies Automatically for information.

Include policies for rare or infrequent scenarios, such as failover, backup restoration, and annual activities.

After allowing necessary application traffic, identify and block unauthorized traffic:

• Prioritize monitoring traffic to and from sensitive applications.

• Investigate suspicious patterns, such as unexpected communication between customer-facing apps and confidential databases.

Work with your colleagues to ensure that the correct policies are applied to the correct workloads.

Initially, when you enforce policies, consider setting the catch-all to Allow. Then, monitor traffic to see what matches the catch-all rule. When no necessary traffic is matching the catch-all rule, you can set the catch-all to Deny.